Cloud Computing. January 21, 2011

Transcription

1 Cloud Computing January 21, 2011 This presentation was created sent by Dorsey & Whitney LLP, 50 South Sixth Street, Suite 1500, Minneapolis, MN This presentation is intended for general information purposes only and should not be construed as legal advice or legal opinions on any specific facts or circumstances. An attorney-client relationship is not created or continued by sending and/or receiving this presentation. Members of Dorsey & Whitney will be pleased to provide further information regarding the matters discussed in this presentation. 1

2 Panel Melissa Krasnow, Partner, Dorsey & Whitney LLP, and Certified Information Privacy Professional Caroline Sweeney, Director, Practice Group Technology Services, Dorsey & Whitney LLP 2

3 Five Characteristics of Cloud Computing On-demand self-service Ubiquitous network access Location independent Rapid elasticity Pay per use Source: NIST (National Institute of Standards and Technology) 3

4 Cloud Computing: Delivery Models IaaS: Infrastructure as a Service Company outsources the equipment used to support operations: storage, hardware, servers, networking components. The provider owns the equipment and is responsible for housing, running and maintaining it. SaaS: Software as a Service Software applications are hosted by a service provider Applications are available to customers over a network, typically the internet. Vendor provides daily technical operation, maintenance, and support: examples: Gmail, virtual data rooms. Per 2010 McKinsey Quarterly, SaaS is growing at a 17% annual rate. Paas: Platform as a Service Offers operating systems and associated services. Salesforce.com is an example. 4

5 The Different Kinds of Clouds Private Operated within a single organization On demand, pay by the hour computing services Can be known as internal clouds Public Available to the general public Examples include Amazon, Google, Facebook, Twitter Managed Hybrid Combination of private and public clouds 5

6 Public Cloud Candidates Applications used by mobile workers to manage their time and activity (sales support, , etc). Software development environments Applications requiring hardware or software not normally used by your company s IT operations Distributed server and data center implementations Test and pre-production systems Marketing and any data that is already on the internet for public consumption as the data is not sensitive and no security breach will compromise the company. Many companies are simply too small to affordably build out their own business network. They can achieve better computing value and higher levels of security on a well-provisioned public cloud. 6

7 Not so good for the Public Cloud Applications that involve extremely sensitive data Applications that contain data where there is a regulatory or legal risk involved in any disclosure Applications that may require intensive workloads and where performance over the internet might be a problem. 7

8 What are the Business Benefits? Delivery of services Faster time to value and time to market Reduction of costs Running application services on a cloud platform moves capital expenses to operational expenses. The business can develop, deploy and use more application services as they require them, without needing huge initial capital investments (and ensuing operational costs) for dedicated infrastructure that may never be needed. IT department transformation Focus on innovation vs. maintenance and implementation Cloud computing can save customers 20 to 30 percent of their IT costs. Changes can be made quickly Source: Donald Leeke,Microsoft 8

9 And (business benefits, continued) Access to data from any location with an internet connection No need for maintaining a physical storage device No ongoing costs of maintaining and upgrading an on-site storage system s hardware and software Pay as you go model allows for reduced operating expenses Can add and remove capacity based on real - rather than projected - storage needs Dedicated security team, security auditing/testing is easier, real-time detection of system tampering 9

10 Flying to the Clouds Expect companies to carefully select projects that benefit from the cloud s features and cost benefits Expect further development of formal cloud computing strategies The cloud has mainly attracted smaller and mediumsized businesses seeking to lower costs Bigger companies, which have voiced more concerns about privacy and security, haven t embraced it 10

11 Flying to the Clouds Retailers and manufacturers are most amenable because the flexibility accommodates annual variations in their employment rolls Financial services and health care are slower to adopt because of privacy concerns Cloud computing is a consideration in recent regulatory initiatives Department of Commerce green paper Electronic Communications Privacy Act should be reviewed regarding privacy protection in cloud computing Also mentioned in the FTC preliminary report on privacy 11

12 Who offers Cloud Computing Services? There are well over 100 cloud data backup providers of one type or another. Easy to try out because of the nature of storage as a service and the lack of capital investment IBM - currently collaborating with corporations, universities, internet-based enterprises and government agencies Yahoo - works with Carnegie Mellon University researchers to modify and evaluate software Google - makes processors in data center available to University of Washington, Stanford, MIT to help students understand cloud computing technology. Amazon S3 - aimed at small to medium businesses, from consumers saving personal data to web startups offering online services and larger companies wanting to back up databases or store archival data Nirvanix - geared toward medium and large users. 12

13 Who offers Cloud Computing Services? Microsoft - in the cloud computing space for 15 years. Hotmail (350 million users), Xbox live (6 million active accounts), Windows Update services 70% of MS employees who are involved in building software are working on entirely cloud-based or cloud-inspired projects. Office2010 and Sharepoint 2010 Include MS Office web applications the cloud companion to Word, PowerPoint, and Excel. Allows users to work from virtually anywhere Companies can acquire licenses based on the number of months they need applications Source: In Their Own Words : Microsoft s Legal Cloud Computing Strategy: Not All or Nothing 13

14 The Cloud and Social Media Disputes over information on MySpace, Facebook,and LinkedIn are becoming increasingly common in courtrooms. These sites reside in the Cloud. Generally, postings and information from these sites will be relevant, admissible, and not privileged. Crispin v. Christian Audigier, Inc., 717 F. Supp.2d 965 (C.D. Cal 2010). In this action arising out of an allege oral contract between the parties, the defendant subpoenaed various social networking websites for relevant ESI. The Court distinguished between remote computing service (RCS) and electronic communications service (ESC) providers under the Stored Communications Act. After concluding the websites were ESC providers under the Act, the court determined the information sought by the subpoenas (private messages and postings) was in electronic storage. Because the Act gave two definitions of that phrase, the court distinguished between , on the one hand, and postings or comments, the latter being not protect-able as a form of temporary, intermediate storage. EEOC v. Simply Storage Management, LLC, No. 1:09-CV-1223 (S.D. Ind. May 11, 2010). Defendants sought discovery of the plaintiffs Facebook and MySpace content to assess plaintiffs claims of emotional distress resulting from alleged sexual harassment. The court permitted the defendants to obtain content that would be reflective of the plaintiffs emotional states, over the EEOC s objections of relevance and that such disclosures would embarrass the plaintiffs. The court noted that the privacy settings on the sites were not a basis for shielding the content from discovery. Evans v. Bayer, 684 F. Supp. 2d 1365 (S.D. Fla. 2010) (holding that student s right to off-campus free speech were violated where she was suspended for creating a group on Facebook entitled "Ms. Sarah Phelps is the worst teacher I've ever met."). Sedie v. United States, 2010 WL (N.D. Cal. Apr. 21, 2010) (admitting evidence from MySpace and Facebook pages to dispute plaintiff s personal injury claims). Romano v. Steelcase Inc., 907 N.Y.S.2d 650 (Sept 1, 2010): Court ordered plaintiff to provide necessary authorization for access to private Facebook and MySpace accounts after finding the public portions of the plaintiff s social networking site contained content that was material and necessary to the litigation, and discerning a reasonable likelihood that the same would hold true as to the private portions. 14

15 The Cloud & Social Media Increasing Regulation Financial Industry Regulatory Advisory (FINRA) Regulatory Notice (January 2010): guidance to securities firms and brokers on communicating with the public through social networking sites. broker-dealer business conducted via social media must be maintained as a record clarifies the responsibilities of firms to supervise the use of social networking sites The UK's Financial Services Authority (FSA) also issued specific guidance on social networks usage in June

16 The Cloud: Challenges and Risks Where is my data? How does my data securely enter and exit the cloud? How is my data protected? Who has access to my data? Who is accountable if something goes wrong? What s the disaster recovery plan, including response to pandemic? How do we comply with export and privacy laws? What is the viability of my cloud vendor? What happens if my cloud provider disappears? How is the environment monitored? How is the data protected and secured from theft and damage? And, how is encryption managed? How easy to integrate with existing IT solutions? Customization capabilities to suit my needs? Will on-demand cost more? Are there any regulatory requirements on my business that can prevent me from using the cloud? Source: An Essential Guide to Possibilities and Risks of Cloud Computing: Maria Spinola 16

17 The Cloud: Challenges and Risks Be aware of hidden costs cost per gigabyte of cloud storage may only be part of the picture Potential fees for data transfers, metadata functions, or copying and deleting files. Internal costs for connecting to the cloud (T1 line, for example). 17

18 Considerations: Data Security & Data Privacy Fall 2009 survey by Mimecast 46 percent of all business respondents cited security as a concern in adopting cloud computing as an IT strategy. The most reluctant sectors included financial services (76%), energy (75%), and government (67%). Within the same survey, 70% of companies that have launched cloud computing initiatives plan to move additional applications and data to the cloud. Cloud security threats from three fronts: from outside, over the internet; from other cloud applications on the network; from the vendor s own IT personnel Threats are no different than security fault potentials on any in-house corporate network. Data access governance concerns danger of data falling into the wrong hands either as a result of people having more privileges than required or by accidental or intentional misuse of the privileges assigned to their job. Data segregation In the cloud your data is typically in a shared environment alongside data from other customers 18

19 Considerations: Data Security & Data Privacy Control over and knowledge/information about data Data What kind? What will be done with data? Where? Data subjects Where? 19

20 Considerations: Records Management Cloud solutions must consider records management requirements, for example: Can the solution implement records disposition schedules, including the ability to transfer and permanently delete records? Cloud providers or managers may no be able to ensure complete deletion of records If particular cloud deployments present insurmountable obstacles to records management, there will be a negative impact on the company s Records program. 20

21 Considerations: E-Discovery Gartner study: Data increasingly lives in the cloud. Companies are increasingly using cloud-based services for , word processing and spreadsheets. These are the three most important targets of discovery and regulatory investigations Spoliation occurs where evidence is destroyed or significantly altered when litigation or investigation is pending or reasonably foreseeable. consequences of spoliation can be severe and may include criminal charges, monetary sanctions, dismissal, suppression or exclusion of evidence, or an adverse inference jury instruction. Consider: How are document holds enforced and how is data preserved? How is metadata protected? How is information searched for, retrieved, and exported pursuant to e- discovery requirements? How is attorney/client privilege maintained? Subpoenas You may not even know about them if vendor gets the subpoena Cooperation With the other party and with your cloud provider 21

22 Considerations: E-discovery F.R.C.P. Rule 34(a)(1): produce and permit the requesting party or its representative to inspect, copy, test, or sample the following items in the responding party s possession, custody, or control. Typically, cloud customer is party in control and cloud service is the party in possession Requesting cloud provider to perform discovery on behalf of customer could present issues regarding Attorney Client privilege Without customer consent, potential to impinge upon Stored Communications Act 22

23 The Cloud and the Law Application of domestic and international laws Cross-border data transfer compliance (e.g., EU Data Protection Directive) Geography / jurisdictions / export law compliance Regulated industries (e.g., financial, health, etc.) Regulatory / legal compliance by provider 23

24 The Cloud & The Law Flagg v. City of Detroit, Slip Copy, 2008 WL (E.D. Mich.) Most significant test for cloud-based deployments is control Party in control over the data is the one that determines discoverability of data in the cloud The third party in possession of data is not required to produce responsive ESI, given the provisions of the SCA No need to subpoena cloud provider, as required evidence was more easily acquired by an e-discovery request to the cloud customer 24

25 United States v. Warshak, 2010 WL (6th Cir. Dec. 14, 2010) The Court considered the question of whether an account holder has an expectation of privacy as to the contents of his s. Ruled the government must have a search warrant before it can secretly seize and search s stored by service providers. Court found that users have the same reasonable expectation of privacy in their stored as they do in their phone calls and postal mail. Given the fundamental similarities between and traditional forms of communication [like postal mail and telephone calls], it would defy common sense to afford s lesser Fourth Amendment protection... It follows that requires strong protection under the Fourth Amendment; otherwise the Fourth Amendment would prove an ineffective guardian of private communication, an essential purpose it has long been recognized to serve... [T]he police may not storm the post office and intercept a letter, and they are likewise forbidden from using the phone system to make a clandestine recording of a telephone call--unless they get a warrant, that is. It only stands to reason that, if government agents compel an ISP to surrender the contents of a subscriber's s, those agents have thereby conducted a Fourth Amendment search, which necessitates compliance with the warrant requirement... 25

26 Warshak, continued Opinion also states: Moreover, to the extent that the SCA purports to permit the government to obtain such s warrantlessly, the SCA is unconstitutional. However, Court agreed that government agents relied in good faith on the Stored Communications Act, even if Defendant s Fourth Amendment rights were violated. it was not plain or obvious that the SCA was unconstitutional, and it was therefore reasonable for the government to rely upon the SCA in seeking to obtain the contents of Warshak s s. Held that reversal was not warranted 26

27 Cloud Contracts: Due Diligence Consider more than one provider Financial strength of provider Insurance coverage of provider What happens if merger or acquisition or bankruptcy involving provider? Has provider had a security breach? Who is data processor? subcontractor? Provider s privacy and related policies, procedures and requirements Customer s privacy and related policies, procedures and requirements 27

28 Cloud Contracts: Approach IT, legal/compliance, privacy and business / management and other functional areas should work together Determine position on issues and develop contract language for this 28

29 Cloud Contracts: Provisions Protection of data Control by customer over data Provider control over data Responsibilities of provider and customer Indemnification, limitation of liability/exceptions and consequential damage disclaimers Pricing, business continuity, termination, service level, compliance, litigation/e-discovery, and auditing/security Relationships Incident response/contingency plans Data breach Controls to prevent data breach, security and controls Data preservation and electronic discovery Service level agreements Handling of failures 29

30 Best Practices: Records Management Define a Cloud Governance Program and train your staff regarding its contents Have Records Management staff review the Cloud provider contract around a security model for preservation of data that includes communication, collaboration, infrastructure, and the application platform. Ensure your Cloud provider agreement guarantees data recovery and assured destruction of data State explicitly in the contract information ownership and control amongst parties Solid records management policies and data governance practices set instructions to capture, manage and retain records; how data will migrate to new formats and operating systems; how to transfer permanent records in the cloud to the records authority; and, create a framework for portability and accessibility issues. Determine which copies of records will be declared as the record copy and mange these in accordance with judicial records management content. Remember, the value of records in the cloud may be greater that the value of the other set because of indexing or other reasons. 30

31 Best Practices & E-Discovery Data can be stored in any country Know where the data center is located, as the physical question raises the question of legal governance over the data. Address which country s court system will settle a dispute in event of a conflict between the cloud vendor and customer Be aware of the prevailing law in that particular nation. For example, German law will not allow documents to leave Germany, so how could you adhere to these requirements in a cloud scenario? The European Network and Information Security Agency - November 2009 report on cloud computing - warns companies remain responsible under UK law for safeguarding their customer s information even if that data is stored by a service provider in the cloud. Intellectual property protection 31

32 Best Practices & E-Discovery Ensure process regarding third party access to stored data Understand format in which data can be exported from the cloud provider Understand back-up protocols The agreement with the provider must contemplate everything involved with e-discovery: notices upon service of process, procedures for receiving discovery requests and issuing litigation holds, protocols for communication and data transfer between litigating attorneys and service provider personnel, pricing, etc. 32

33 Questions 33